CVE-2026-4324
Medium
Description
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSatellite 6.17
PublishedMar 17, 2026
First seenMar 17, 2026
Weakness typeCWE-89SQL injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| satellite 6.17 | No range specified | — |
| satellite 6.18 | No range specified | — |
| satellite 6.19 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.